Two years ago in this month, a 9-judge bench of the Supreme Court (SC) held that Indians have a constitutionally protected fundamental right to privacy.
This was the judgment given in Justice K.S.Puttaswamy (Retd) vs Union of India case.
What was the case?
It held that privacy is a natural right that inheres in all-natural persons.
It also said that this right may be restricted only by state action that passes each of the following three tests:
Such state action must have a legislative mandate.
It must be pursuing a legitimate state purpose.
It must be proportionate i.e., such state action (both in its nature and extent) must be necessary in a democratic society and the action ought to be the least intrusive of the available alternatives to accomplish the ends.
What are the prescribed high standards?
This judgment fundamentally changed the way in which the government viewed its citizens’ privacy (both in practice and prescription).
It undertook structural reforms and brought transparency and openness in the process of commissioning and executing its surveillance projects, and built a mechanism of judicial oversight over surveillance requests.
It demonstrated great care and sensitivity in dealing with the personal information of its citizens.
It legislated a transformative, rights-oriented data protection law that held all powerful entities that deal with citizens’ personal data, including the state, accountable.
What was the data protection law about?
This law embodied the principle that the state must be a model data controller and prescribed a higher standard of observance for the state.
It banned the practice of making access to essential services contingent on the citizen parting with irrelevant personal information.
This law established an effective privacy commission that is tasked with enforcing, protecting and fulfilling the fundamental right to privacy implemented through the specific rights under the legislation.
This law also revolutionised the technology sector landscape in the country, paving way for innovative privacy-aware and privacy-preserving technical solution providers to thrive and flourish, and establishing the country as a global leader in the space.
This fairytale would have been the story of the last two years if the government had followed the script. But it did the exact opposite.
The judgment in K.S. Puttaswamy case affected little change in the government’s thinking or practice as it related to privacy and the personal data of its citizens.
How was national security used as a reason?
The law continued to execute mass surveillance programmes with little regard for necessity or proportionality, with justifications always voiced in terms of broad national security talking points.
Ministry of Home Affairs (December 2018) - Authorised 10 Central agencies to intercept, monitor and decrypt any information generated, transmitted, received or stored in any computer in the country.
This notification is presently under challenge before the Supreme Court.
Ministry of Information Broadcasting (July 2018) - Floated a tender for ‘Social Media Monitoring Hub’, a technical solution to snoop on all social media communications, including e-mail.
The government had to withdraw this following the SC’s stinging rebuke.
Unique Identification Authority of India (UIDAI) (August 2018) - Has had a request for proposal for a similar social media surveillance programme was floated which is also presently under challenge before the SC.
The Income-Tax department has its ‘Project Insight’ which also has similar mass surveillance ends. These are but a few examples.
How is data usage against privacy?
The government has rejected the rights-oriented approach in the collection, storage and processing of personal data and has stuck to its ‘public good’ and ‘data is the new oil’ discourse.
This convenient revival of the idea of privacy to mere information security appears to inform all its policies.
This is evident from Economic Survey 2018-19 as it commends the government for having been able to sell and monetise the vehicle owners’ data in the Vahan database.
The government also urged to replicate the above success with other databases.
The Justice Srikrishna committee which has published the draft Personal Data Protection Bill uses a similar language of ‘free and fair digital economy’.
This means that digital economy is its end and the notion of privacy is merely a shaper of the means, which not only misrepresents the bill’s purpose, but also its history and the mischief that it intended to tackle.
The committee made the choices it made despite being aware that the courts are likely to interpret every provision of the legislation purposively.
What is still hopefully possible?
As the K.S. Puttaswamy case ages and steps into its third year, the script is still on the table and the rights-oriented data protection legislation is hopefully still possible.
This legislation should include comprehensive surveillance reform prohibiting mass surveillance and institution of a judicial oversight mechanism for targeted surveillance.
It should recognise the principle that the state should be a model data controller as it deals with its citizens’ personal information.
